Privacy Policy

TruEXP ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services (collectively, the "Service"). This Privacy Policy complies with the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and other applicable privacy laws. California residents have specific rights regarding their personal information as described in Section 12. Please read this Privacy Policy carefully. When you use the Service, you will be asked to provide consent for certain data collection and uses as described in this policy. For marketing communications and non-essential data uses, we use an opt-in model requiring your affirmative consent. If you do not agree with this policy, please do not use our Service.

We collect several types of information from and about users of our Service: **Personal Identification Information:** • Name, email address, phone number • Username (passwords are managed by Auth0, our authentication provider, and are never stored by TruEXP) • Business name and business contact information • Government-issued ID (for identity verification when required) **Event and Transaction Information:** • Event attendance history • Event registrations and RSVPs • Communication preferences **Usage and Device Information:** • IP address, browser type, and device information • Log files and analytics data • Cookies and similar tracking technologies • Location information (with your permission) • How you interact with our Service **User-Generated Content:** • Profile information and photos • Event listings and descriptions • Reviews and ratings • Communications with other users • Customer support interactions We collect information: • Directly from you when you provide it • Automatically when you use our Service • From third parties such as Auth0 (our authentication provider), analytics providers, and social media platforms

We use the information we collect for various purposes, including: **Service Delivery:** • Providing, maintaining, and improving our Service • Managing event registrations and RSVPs • Managing your account and providing customer support • Sending administrative information, updates, and security alerts **Business Operations:** • Facilitating event management and fan engagement • Preventing fraud and abuse • Verifying identity and eligibility • Analyzing usage patterns to improve our Service **Communication:** • Responding to your inquiries and requests • Sending marketing communications (only after you opt-in via notification preferences in your account settings) • Notifying you about events, offers, and updates (based on your notification preferences) • Conducting surveys and collecting feedback **Legal and Safety:** • Complying with legal obligations • Protecting against fraud, abuse, and security risks • Enforcing our Terms of Service • Resolving disputes and troubleshooting problems **Analytics and Improvement:** • Understanding how users interact with our Service • Developing new features and functionality • Conducting research and analysis • Testing and monitoring Service performance

We may share your information in the following circumstances: **Service Providers:** We share information with third-party vendors who perform services on our behalf, including: • Authentication services (Auth0 by Okta - manages user login and authentication) • Cloud hosting and storage providers • Analytics and marketing platforms • Push notification services (OneSignal) • Customer support tools • Security and fraud prevention services These providers are contractually obligated to use your information only as necessary to provide services to us and are prohibited from selling your information. **Business Users:** When you purchase tickets or interact with events, we share relevant information with the business users who organize those events. This may include your name, contact information, and purchase details. **Legal Requirements:** We may disclose your information when required by law or to: • Comply with legal processes, subpoenas, or court orders • Respond to government requests • Enforce our Terms of Service • Protect our rights, property, or safety • Investigate fraud or security issues • Prevent harm to users or the public **Business Transfers:** In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have. **With Your Consent:** We may share your information for other purposes with your explicit consent. **Aggregated or De-identified Data:** We may share aggregated or de-identified information that cannot reasonably be used to identify you. This information is not subject to this Privacy Policy.

We use cookies, web beacons, pixels, and similar tracking technologies to collect information about your browsing activities. These technologies help us: • Remember your preferences and settings • Authenticate your account • Analyze usage patterns and trends • Deliver personalized content and advertising • Measure marketing campaign effectiveness **Types of Cookies We Use:** • Essential cookies: Required for the Service to function properly • Functional cookies: Remember your preferences and choices • Analytics cookies: Help us understand how you use the Service • Advertising cookies: Deliver relevant ads and measure their effectiveness **Your Cookie Choices:** Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies. However, this may prevent you from taking full advantage of our Service. You can opt out of interest-based advertising through: • Network Advertising Initiative (NAI): www.networkadvertising.org/choices • Digital Advertising Alliance (DAA): www.aboutads.info/choices • Your mobile device settings (for mobile advertising) **Cookie Consent:** When you first visit our Service, you may be presented with information about our use of cookies. You can control cookies through: • Your browser settings (instructions available at your browser's help menu) • Opting out of interest-based advertising through NAI and DAA (links provided above) • Managing your notification preferences in account settings for marketing cookies **Do Not Track Signals:** Some browsers support "Do Not Track" signals. We currently do not respond to Do Not Track signals because there is no industry standard for how to interpret them. However, you can control tracking through the cookie settings described above.

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include: • Encryption of data in transit and at rest • Regular security assessments and audits • Access controls and authentication mechanisms • Employee training on data protection • Incident response procedures **Authentication Security:** User authentication and password security are managed by Auth0 (by Okta), a SOC 2 Type II certified identity and access management provider. Auth0 employs industry-leading security practices including: • Multi-factor authentication support • Breach detection and anomaly monitoring • Encrypted password storage (TruEXP never stores or has access to your passwords) • Regular third-party security audits However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security. If we become aware of a data breach that compromises your personal information, we will notify you as required by applicable law.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods depend on: • The nature of the information collected • The purposes for which it is processed • Legal, regulatory, tax, accounting, or reporting requirements • Whether disputes or investigations are pending When we no longer need your information, we will securely delete or anonymize it. You may request deletion of your account and personal information as described in Section 8.

Depending on your location, you may have certain rights regarding your personal information: **Access and Portability:** • Request a copy of the personal information we hold about you • Receive your information in a structured, commonly used format • Request that we transmit your information to another organization **Correction and Updating:** • Update or correct inaccurate or incomplete personal information • You can update most information directly in your account settings **Deletion:** • Request deletion of your personal information • Note that we may retain certain information as required by law or for legitimate business purposes **Objection and Restriction:** • Object to certain types of processing of your personal information • Request that we restrict how we use your information **Marketing Communications and Notifications:** TruEXP uses an opt-in model for marketing and notifications. You must affirmatively consent to receive communications: • Control all notification preferences via easy-to-use toggles in your account settings (available in both the business dashboard and fan mobile app) • Opt out of marketing emails at any time by clicking "unsubscribe" in any marketing email • Manage push notifications through OneSignal preference settings • Note that you cannot opt out of essential administrative or security communications (e.g., account security alerts, terms updates) To exercise these rights, please contact us using the information in Section 14. We will respond to your request within the timeframe required by applicable law, typically within 30-45 days. We may need to verify your identity before processing your request. We will not discriminate against you for exercising your privacy rights.

Our Service is not intended for children under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children under 13. If you are under 13, do not: • Use or provide any information on the Service • Register an account or make purchases • Provide any information about yourself, including your name, address, telephone number, or email address If we learn that we have collected personal information from a child under 13 without parental consent, we will delete that information as quickly as possible. If you believe we might have information from or about a child under 13, please contact us immediately. For users between 13 and 18, we recommend that parents or guardians review this Privacy Policy and supervise their children's use of the Service.

Our Service may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy applies only to information collected by our Service. We are not responsible for the privacy practices of third-party websites or services. We encourage you to review the privacy policies of any third-party sites you visit or services you use. When you use third-party services integrated with our platform, those third parties may collect information about you. Their collection and use of your information is subject to their own privacy policies: • Auth0 (Authentication): https://auth0.com/privacy • OneSignal (Push Notifications): https://onesignal.com/privacy_policy • Social media platforms you choose to connect

Your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from the laws of your country. By using our Service, you consent to the transfer of your information to countries outside of your country of residence, including the United States. When we transfer personal information internationally, we implement appropriate safeguards to protect your information, including: • Standard contractual clauses approved by relevant authorities • Ensuring third parties are certified under appropriate data protection frameworks • Obtaining your explicit consent when required by law

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA): **Right to Know:** You have the right to request that we disclose: • The categories and specific pieces of personal information we collected • The categories of sources from which we collected personal information • Our business or commercial purpose for collecting or selling personal information • The categories of third parties with whom we share personal information • The categories of personal information we sold or disclosed for a business purpose **Right to Delete:** You have the right to request deletion of your personal information, subject to certain exceptions. **Right to Opt-Out of Sale:** California residents have the right to opt out of the "sale" of personal information. While we do not sell personal information in the traditional sense, certain data sharing practices may be considered a "sale" under CCPA. **Right to Correct:** You have the right to request correction of inaccurate personal information. **Right to Limit Use of Sensitive Personal Information:** You have the right to limit our use of sensitive personal information to certain purposes. **Right to Non-Discrimination:** We will not discriminate against you for exercising your CCPA rights. This means we will not: • Deny goods or services to you • Charge different prices or rates • Provide a different level or quality of goods or services • Suggest that you will receive different prices, rates, or quality **Authorized Agents:** You may designate an authorized agent to make requests on your behalf. We may require verification of the agent's authority. **Shine the Light Law:** Under California Civil Code Section 1798.83 (the "Shine the Light" law), California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. **Categories of Personal Information Collected:** In the past 12 months, we have collected the following categories of personal information as defined by CCPA: • Identifiers (name, email, IP address, etc.) • Commercial information (purchase history, transaction records) • Internet or network activity (browsing history, interactions with our Service) • Geolocation data • Professional or employment information (for business users) • Inferences drawn from the above to create consumer profiles **Sources of Personal Information:** • Directly from you • Automatically through your use of the Service • From third-party service providers • From social media platforms • From business partners and affiliates **Business or Commercial Purpose:** We collect and use personal information for the purposes described in Section 3 of this Privacy Policy. **Categories of Third Parties:** We share personal information with the categories of third parties described in Section 4 of this Privacy Policy. To exercise your California privacy rights, please: • Email us at privacy@truexp.com • Submit a request through your account settings (notification preferences toggles) • Mail us at [Physical Address - To be provided by legal counsel] We will verify your identity before processing your request and respond within 45 days (with a possible 45-day extension if needed). **Do Not Sell My Personal Information:** To opt out of the sale of your personal information, please email privacy@truexp.com with "CCPA Opt-Out Request" in the subject line. While we do not sell personal information in the traditional sense, you have the right to opt out of data sharing that may be considered a "sale" under CCPA.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by: • Posting the updated Privacy Policy on our Service • Updating the "Last Updated" date at the top of this policy • Sending you an email notification (for material changes) • Displaying a prominent notice on our Service We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the updated Privacy Policy. If you do not agree to the modified terms, you should discontinue your use of the Service.

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us: **TruEXP Privacy Team** Email: privacy@truexp.com Phone: [Your Business Phone] Address: [Your Physical Address] For California residents exercising CCPA rights: Email: privacy@truexp.com Subject Line: "California Privacy Rights Request" We will respond to your inquiry as promptly as possible, typically within 30-45 days. **California Residents - Additional Contact Information:** Complaint Assistance Unit Division of Consumer Services California Department of Consumer Affairs 1625 North Market Blvd., Suite N 112 Sacramento, CA 95834 Phone: (916) 445-1254 or (800) 952-5210

By using our Service, you consent to this Privacy Policy and agree to its terms. If you do not agree to this policy, please do not use our Service. For certain activities, we may ask for your explicit consent. In those cases, we will clearly explain what information we collect, how we will use it, and obtain your affirmative consent before proceeding. You may withdraw your consent at any time by contacting us or adjusting your privacy settings. However, withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.